October 2023 - Freeradius-Users - lists.freeradius.org

supported os
by Andrei Katsuk 23 Oct '23

23 Oct '23

Hello! I found on https://wiki.freeradius.org/building/Platforms that Officially supported linux platforms are: CentOS Red Hat Debian Ubuntu Also I found on https://hub.docker.com/r/freeradius/freeradius-server/ that freeradius docker image is based on alpine image. Does it mean that alpine os is also officially supported ? Which linux os you suggest to use as the base os for docker image with freeradius ? Thanks in advance, Andrei

5 6

Konfig FreeRadius with Mikrotik-Routerboard - IP-Pool SQL
by Florian Traxler (mieX GmbH) 20 Oct '23

20 Oct '23

Hello! I currently have a FreeRADIUS version 3.0.20 installed on an Ubuntu 20.04.6 LTS and connected to a Mikrotik router board. Here the connection is made via PPP and DHCP and authentication is requested at the Radius. The aim of the configuration would be to provide the IP, which is now assigned via the IP pool by Mikrotik, directly via the FreeRadius database. Is this even possible in combination with Mikrotik? Thanks for the help.

4 5

Re: How setup simultaneous-use?
by ti.suporte＠lupusequipamentos.com.br 11 Oct '23

11 Oct '23

Alan, Firstly, thank you for your attention! I check the settings as you recommended see the details: First I sent an authentication package via radclient and everything seemed to go well. echo "User-Name=allan, User-Password=teste1234" | radclient localhost:1812 auth testing123 (0) Received Access-Request Id 30 from 127.0.0.1:39052 to 127.0.0.1:1812 length 45 (0) User-Name = "allan" (0) User-Password = "teste1234" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "allan", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> allan (0) sql: SQL-User-Name set to 'allan' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "teste1234" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (0) sql: Group "wifi": Conditional check items matched (0) sql: Group "wifi": Merging assignment check items (0) sql: Simultaneous-Use := 1 (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (0) sql: Group "wifi": Merging reply items rlm_sql (sql): Released connection (1) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section session from file /etc/freeradius/3.0/sites-enabled/default (0) session { (0) radutmp: EXPAND /var/log/freeradius/radutmp (0) radutmp: --> /var/log/freeradius/radutmp (0) radutmp: EXPAND %{User-Name} (0) radutmp: --> allan (0) [radutmp] = ok (0) } # session = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> allan (0) sql: SQL-User-Name set to 'allan' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'allan', 'teste1234', 'Access-Accept', '2023-10-11 18:49:57.016895' ) (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'allan', 'teste1234', 'Access-Accept', '2023-10-11 18:49:57.016895' ) (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = ok (0) Sent Access-Accept Id 30 from 127.0.0.1:1812 to 127.0.0.1:39052 length 20 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 30 with timestamp +4 due to cleanup_delay was reached Ready to process requests After I sent an accounting package, but something seems wrong with the "radutmp" file. Also, there seemed to be some errors with the mysql socket but in the end it is shown that the 'accounting' operation "went well". echo "User-Name=allan, User-Password=teste1234" | radclient localhost:1813 acct testing123 Ready to process requests (1) Received Accounting-Request Id 108 from 127.0.0.1:56660 to 127.0.0.1:1813 length 45 (1) User-Name = "allan" (1) User-Password = ":\270\236\034|\236޿\214c^S\006\3361`" (1) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) policy acct_unique { (1) update request { (1) &Tmp-String-9 := "ai:" (1) } # update request = noop (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (1) EXPAND %{hex:&Class} (1) --> (1) EXPAND ^%{hex:&Tmp-String-9} (1) --> ^61693a (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> 375c5dce389b47d1a42e4e8d8fb01b42 (1) &Acct-Unique-Session-Id := 375c5dce389b47d1a42e4e8d8fb01b42 (1) } # update request = noop (1) } # else = noop (1) update request { (1) &Tmp-String-9 !* ANY (1) } # update request = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "allan", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/default (1) accounting { (1) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (1) detail: --> /var/log/freeradius/radacct/127.0.0.1/detail-20231011 (1) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20231011 (1) detail: EXPAND %t (1) detail: --> Wed Oct 11 18:51:30 2023 (1) [detail] = ok (1) unix: no Accounting-Status-Type attribute in request (1) [unix] = noop (1) radutmp: No Accounting-Status-Type record (1) [radutmp] = noop (1) sql: EXPAND %{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query} (1) sql: --> type.accounting.query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (1) sql: EXPAND %{User-Name} (1) sql: --> allan (1) sql: SQL-User-Name set to 'allan' (1) sql: EXPAND SELECT true (1) sql: --> SELECT true (1) sql: Executing query: SELECT true (1) sql: SQL query returned: success (1) sql: -1 record(s) updated (1) sql: No additional queries configured rlm_sql (sql): Released connection (3) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 rlm_sql (sql): Closing expired connection (6) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (5) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (4) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (1) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing expired connection (0) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket (1) [sql] = noop (1) [exec] = noop (1) attr_filter.accounting_response: EXPAND %{User-Name} (1) attr_filter.accounting_response: --> allan (1) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated (1) Sent Accounting-Response Id 108 from 127.0.0.1:1813 to 127.0.0.1:56660 length 20 (1) Finished request (1) Cleaning up request packet ID 108 with timestamp +97 due to done Ready to process requests look at the permissions of the "radutmp" file, it is not writing anything to it. When tested with the server in debug mode, the accounting packages are showing "failed": (62) Received Accounting-Request Id 202 from 192.168.5.122:37900 to 192.168.2.124:1813 length 217 (62) Acct-Status-Type = Start (62) Acct-Authentic = RADIUS (62) User-Name = "allan" (62) NAS-IP-Address = 192.168.5.122 (62) Framed-IP-Address = 192.168.5.71 (62) NAS-Identifier = "62223237ad6a" (62) Called-Station-Id = "62-22-32-37-AD-6A:TestLP" (62) NAS-Port-Type = Wireless-802.11 (62) Service-Type = Framed-User (62) Calling-Station-Id = "30-89-4A-03-E8-78" (62) Connect-Info = "CONNECT 0Mbps 802.11a" (62) Acct-Session-Id = "F1B9944619AE1244" (62) Acct-Multi-Session-Id = "90283D1835963A73" (62) WLAN-Pairwise-Cipher = 1027076 (62) WLAN-Group-Cipher = 1027076 (62) WLAN-AKM-Suite = 1027077 (62) WLAN-Group-Mgmt-Cipher = 1027078 (62) Event-Timestamp = "Oct 11 2023 17:07:16 -03" (62) Acct-Delay-Time = 3 (62) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (62) preacct { (62) [preprocess] = ok (62) policy acct_unique { (62) update request { (62) &Tmp-String-9 := "ai:" (62) } # update request = noop (62) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (62) EXPAND %{hex:&Class} (62) --> (62) EXPAND ^%{hex:&Tmp-String-9} (62) --> ^61693a (62) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (62) else { (62) update request { (62) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (62) --> 9d456cff7c990d3febc8914a36a8fff9 (62) &Acct-Unique-Session-Id := 9d456cff7c990d3febc8914a36a8fff9 (62) } # update request = noop (62) } # else = noop (62) update request { (62) &Tmp-String-9 !* ANY (62) } # update request = noop (62) } # policy acct_unique = noop (62) suffix: Checking for suffix after "@" (62) suffix: No '@' in User-Name = "allan", looking up realm NULL (62) suffix: No such realm "NULL" (62) [suffix] = noop (62) [files] = noop (62) } # preacct = ok (62) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/default (62) accounting { (62) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (62) detail: --> /var/log/freeradius/radacct/192.168.5.122/detail-20231011 (62) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.5.122/detail-20231011 (62) detail: EXPAND %t (62) detail: --> Wed Oct 11 17:07:19 2023 (62) [detail] = ok (62) [unix] = fail (62) } # accounting = fail (62) Not sending reply to client. (62) Finished request Once again, thank you for your attention! This is my first experience with RADIUS and I don't know any specialized personnel in my region. Best regards, Allan Cristian. -----Mensagem original----- De: Freeradius-Users <freeradius-users-bounces+ti.suporte=lupusequipamentos.com.br(a)lists.freeradius.org> Em nome de freeradius-users-request(a)lists.freeradius.org Enviada em: quarta-feira, 11 de outubro de 2023 09:00 Para: freeradius-users(a)lists.freeradius.org Assunto: Freeradius-Users Digest, Vol 222, Issue 12 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. And then there were 4. (Alan DeKok) 2. Re: And then there were 4. (Conrad Classen) 3. Re: And then there were 4. (Matthew Newton) 4. Re: How setup simultaneous-use? (Alan DeKok) 5. Re: And then there were 4. (Matt Zagrabelny) 6. Re: And then there were 4. (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Tue, 10 Oct 2023 15:05:26 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: And then there were 4. Message-ID: <933CD530-15C5-460E-BBB4-86075BA70C94(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii We're happy to release the first alpha of version 4.0. The full release notes are online at: https://freeradius.org/4.0/alpha.html Packages are available at: https://freeradius.org/ftp/pub/freeradius/ This isn't the full release of version 4. We expect that next year. But it has major improvements over version 3. Please try it and see what you think. Not all features are available (RadSec is missing, as is PEAP and TTLS). We don't expect major changes between now and the full 4.0. There will be changes, but the major work of re-architecture is done. Alan DeKok. ------------------------------ Message: 2 Date: Tue, 10 Oct 2023 21:08:19 +0200 From: Conrad Classen <conrad.classen(a)gmail.com> To: freeradius-users(a)lists.freeradius.org Subject: Re: And then there were 4. Message-ID: <e4ea31d4-2084-44bb-9115-f8723bad0579(a)gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Hi Alan and dev team, congratulations, that was a lot of work and effort that went into this. Thank-you, and I look forwards to playing with v4-Alpha Much appreciated On 2023/10/10 21:05, Alan DeKok wrote: > We're happy to release the first alpha of version 4.0. The full release notes are online at: > > https://freeradius.org/4.0/alpha.html > > Packages are available at: > > https://freeradius.org/ftp/pub/freeradius/ > > This isn't the full release of version 4. We expect that next year. But it has major improvements over version 3. > > Please try it and see what you think. Not all features are available (RadSec is missing, as is PEAP and TTLS). > > We don't expect major changes between now and the full 4.0. There will be changes, but the major work of re-architecture is done. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? > Seehttp://www.freeradius.org/list/users.html ------------------------------ Message: 3 Date: Tue, 10 Oct 2023 20:25:39 +0100 From: Matthew Newton <mcn(a)freeradius.org> To: freeradius-users(a)lists.freeradius.org Subject: Re: And then there were 4. Message-ID: <3744ec70-5e10-450a-b0d8-63f53eb00c65(a)freeradius.org> Content-Type: text/plain; charset=UTF-8; format=flowed On 10/10/2023 20:05, Alan DeKok wrote: > We're happy to release the first alpha of version 4.0. The full release notes are online at: > > https://freeradius.org/4.0/alpha.html > > Packages are available at: > > https://freeradius.org/ftp/pub/freeradius/ As usual, Network RADIUS are providing pre-built packages packages for common Linux distributions. Details for these repositories are available from the following web page: https://networkradius.com/packages/4.0/ Note that you *must* have the most recent version of libkqueue installed to use v4. No distributions include this (as far as I am aware). Any libkqueue packages they provide have bugs that will likely cause FreeRADIUS to randomly crash. Network RADIUS therefore also provide packages for libkqueue. The instructions on the above page include adding the "extras" repo which includes this. -- Matthew ------------------------------ Message: 4 Date: Tue, 10 Oct 2023 15:59:21 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: How setup simultaneous-use? Message-ID: <4C2EA627-71B4-44BC-A19E-B297A1D6BC0F(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Oct 10, 2023, at 8:07 AM, ti.suporte(a)lupusequipamentos.com.br wrote: > I need to block multiple connections for users and i need help to setup the > "Simultaneous-Use" with SQL. > > I see around forums, the documentation and others communities for help to > config this atribute, and i dont has no more ideas. In order for Simultaneous-Use to work, not only the server has to be configured properly. The NAS has to be configured, too. The NAS *must* send accounting packets. If it doesn't, Simultaneous-Use won't work. You have Simultaneous-Use configured, which is a good start. But the next steps are: * verify that the server is receiving accounting packets * verify that the accounting packets are going into SQL Then in order to make sure that you can test this feature without affecting production: * use the real accounting packets to create "fake" ones for a test user. Change the User-Name in the packet. * set up a test user. Make sure it's only User-Name and password. Don't worry about EAP. * use radclient to send an Access-Request. Verify that Simultaneous-use is being applied. * the server is seeing Simultaneous-Use in the configs * the server is checking SQL * the server is returning Access-Accept * Then send an accounting start packet for that user, using radclient. * verify that radclient sees an Accounting-Response * verify that the accounting data is entered in SQL * Then send _another_ Access-Request for the same user * verify that the Simultaneous-Use / SQL checks are done as above * verify that the server returns Access-Reject * use radclient to send Accounting Stop for the test user * this cleans up the entry in SQL. It's not enough to just configure Simultaneous-Use. This is RADIUS, and there's a whole lot going on behind the scenes. You have to ensure that every little piece is working correctly. Alan DeKok. ------------------------------ Message: 5 Date: Tue, 10 Oct 2023 15:08:47 -0500 From: Matt Zagrabelny <mzagrabe(a)d.umn.edu> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: And then there were 4. Message-ID: <CAOLfK3XVf4hMjz9UxKgviyJbbTK7Ae7iwnaJYY15=N1aWtB06w(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hello! On Tue, Oct 10, 2023 at 2:05?PM Alan DeKok <aland(a)deployingradius.com> wrote: > We're happy to release the first alpha of version 4.0. The full release > notes are online at: > Well done, Alan and team! > > https://freeradius.org/4.0/alpha.html > > Packages are available at: > > https://freeradius.org/ftp/pub/freeradius/ > > This isn't the full release of version 4. We expect that next year. > Thank you for reading my mind, Alan. I was mulling the idea of sending an email asking that exact question. Add clairvoyance to the feature list of v4. Again, we're very appreciative for your efforts, help, and generosity in both the software you provide, and assistance you give on the mailing list. Cheers! -m ------------------------------ Message: 6 Date: Tue, 10 Oct 2023 16:51:40 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: And then there were 4. Message-ID: <E883CC86-9CF6-4B61-A7A5-9DA19CFCBD84(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Oct 10, 2023, at 4:08 PM, Matt Zagrabelny via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > Well done, Alan and team! Thanks. It's been an enormous amount of work. > Thank you for reading my mind, Alan. I was mulling the idea of sending an > email asking that exact question. Add clairvoyance to the feature list of > v4. :) We plan on releasing v4 next August, in time for the 25th anniversary of FreeRADIUS. > Again, we're very appreciative for your efforts, help, and generosity in > both the software you provide, and assistance you give on the mailing list. You're welcome. Alan DeKok. ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 222, Issue 12 *************************************************

2 1

And then there were 4.
by Alan DeKok 10 Oct '23

10 Oct '23

We're happy to release the first alpha of version 4.0. The full release notes are online at: https://freeradius.org/4.0/alpha.html Packages are available at: https://freeradius.org/ftp/pub/freeradius/ This isn't the full release of version 4. We expect that next year. But it has major improvements over version 3. Please try it and see what you think. Not all features are available (RadSec is missing, as is PEAP and TTLS). We don't expect major changes between now and the full 4.0. There will be changes, but the major work of re-architecture is done. Alan DeKok.

4 4

How setup simultaneous-use?
by ti.suporte＠lupusequipamentos.com.br 10 Oct '23

10 Oct '23

Hi, I need to block multiple connections for users and i need help to setup the "Simultaneous-Use" with SQL. I see around forums, the documentation and others communities for help to config this atribute, and i dont has no more ideas. Table radcheck: +----+----------+--------------------+----+--------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+--------------+ | 1 | allan | Cleartext-Password | := | teste1234 | +----+----------+--------------------+----+--------------+ Table radusergroup: +----+----------+-----------+----------+ | id | username | groupname | priority | +----+----------+-----------+----------+ | 1 | allan | wifi | 1 | +----+----------+-----------+----------+ Table radgroupcheck: +----+-----------+------------------+----+-------+ | id | groupname | attribute | op | value | +----+-----------+------------------+----+-------+ | 1 | wifi | Simultaneous-Use | := | 1 | +----+-----------+------------------+----+-------+ FreeRADIUS Version 3.2.1 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/sql including configuration file /etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/expr including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/accounting including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-A ddress}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/3.0/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct a LEFT OUTER JOIN nasreload n USING (nasipaddress) WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL AND (a.acctstarttime > n.reloadtime OR n.reloadtime IS NULL)" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct a LEFT OUTER JOIN nasreload n USING (nasipaddress) WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL AND (a.acctstarttime > n.reloadtime OR n.reloadtime IS NULL)" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime = '%{%{integer:Event-Timestamp}:-%l}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime = '%{%{integer:Event-Timestamp}:-%l}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}' )" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctinterval = %{%{integer:Event-Timestamp}:-%l} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/3.0/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-A ddress}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-A ddress}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-A ddress}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-A ddress}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } instantiate { } # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no reject_unknown_intermediate_ca = no ecdh_curve = "" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "sql" from file /etc/freeradius/3.0/mods-enabled/sql rlm_sql_mysql: libmysql version: 8.0.34 mysql { tls { tls_required = no check_cert = no check_cert_cn = no } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Adding client 192.168.5.0/24 () to default clients list No 'clients' configuration item in first listener of virtual server default. Adding client to global client list rlm_sql (192.168.5.0): Client "" (sql) added rlm_sql (sql): Released connection (0) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/coa # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 53482 Listening on proxy address :: port 54068 Ready to process requests (0) Received Access-Request Id 100 from 192.168.5.122:37035 to 192.168.2.124:1812 length 232 (0) User-Name = "allan" (0) NAS-IP-Address = 192.168.5.122 (0) NAS-Identifier = "62223237ad69" (0) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "9C-30-5B-FF-57-C7" (0) Connect-Info = "CONNECT 0Mbps 802.11g" (0) Acct-Session-Id = "4F42900D48C05B30" (0) Acct-Multi-Session-Id = "C4E290913619F242" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027076 (0) WLAN-AKM-Suite = 1027077 (0) WLAN-Group-Mgmt-Cipher = 1027078 (0) Filter-Id = "wpa-eap" (0) Framed-MTU = 1400 (0) EAP-Message = 0x02fe000a01616c6c616e (0) Message-Authenticator = 0xc0e9a94c0eef117b43a331b6ccc6568c (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "allan", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 254 length 10 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 255 length 22 (0) eap: EAP session adding &reply:State = 0xbe5e90bfbea1947e (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 100 from 192.168.2.124:1812 to 192.168.5.122:37035 length 80 (0) EAP-Message = 0x01ff001604108ab24bfcc081c9c83dbd9bc68668c763 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xbe5e90bfbea1947e1fec683d113a9433 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 101 from 192.168.5.122:37035 to 192.168.2.124:1812 length 247 (1) User-Name = "allan" (1) NAS-IP-Address = 192.168.5.122 (1) NAS-Identifier = "62223237ad69" (1) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Calling-Station-Id = "9C-30-5B-FF-57-C7" (1) Connect-Info = "CONNECT 0Mbps 802.11g" (1) Acct-Session-Id = "4F42900D48C05B30" (1) Acct-Multi-Session-Id = "C4E290913619F242" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027076 (1) WLAN-AKM-Suite = 1027077 (1) WLAN-Group-Mgmt-Cipher = 1027078 (1) Filter-Id = "wpa-eap" (1) Framed-MTU = 1400 (1) EAP-Message = 0x02ff0007031915 (1) State = 0xbe5e90bfbea1947e1fec683d113a9433 (1) Message-Authenticator = 0x81666d2ef094bbf85a6a5684b5c23b67 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "allan", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 255 length 7 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop (1) sql: EXPAND %{User-Name} (1) sql: --> allan (1) sql: SQL-User-Name set to 'allan' rlm_sql (sql): Reserved connection (1) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (1) sql: User found in radcheck table (1) sql: Conditional check items matched, merging assignment check items (1) sql: Cleartext-Password := "teste1234" (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (1) sql: User found in the group table (1) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (1) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (1) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (1) sql: Group "wifi": Conditional check items matched (1) sql: Group "wifi": Merging assignment check items (1) sql: Simultaneous-Use := 1 (1) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (1) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (1) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (1) sql: Group "wifi": Merging reply items rlm_sql (sql): Released connection (1) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 (1) [sql] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xbe5e90bfbea1947e (1) eap: Finished EAP session with state 0xbe5e90bfbea1947e (1) eap: Previous EAP request found for state 0xbe5e90bfbea1947e, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: (TLS) Initiating new session (1) eap: Sending EAP Request (code 1) ID 0 length 6 (1) eap: EAP session adding &reply:State = 0xbe5e90bfbf5e897e (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) session-state: Saving cached attributes (1) Framed-MTU = 994 (1) Sent Access-Challenge Id 101 from 192.168.2.124:1812 to 192.168.5.122:37035 length 64 (1) EAP-Message = 0x010000061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xbe5e90bfbf5e897e1fec683d113a9433 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 102 from 192.168.5.122:37035 to 192.168.2.124:1812 length 412 (2) User-Name = "allan" (2) NAS-IP-Address = 192.168.5.122 (2) NAS-Identifier = "62223237ad69" (2) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) Calling-Station-Id = "9C-30-5B-FF-57-C7" (2) Connect-Info = "CONNECT 0Mbps 802.11g" (2) Acct-Session-Id = "4F42900D48C05B30" (2) Acct-Multi-Session-Id = "C4E290913619F242" (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027076 (2) WLAN-AKM-Suite = 1027077 (2) WLAN-Group-Mgmt-Cipher = 1027078 (2) Filter-Id = "wpa-eap" (2) Framed-MTU = 1400 (2) EAP-Message = 0x020000ac1980000000a2160303009d010000990303652536c123e82efbc81b56128fcd59f7 ec4f86525550980aeb73dabb1c61f56300002ac02cc02bc030c02f009f009ec024c023c028c0 27c00ac009c014c013009d009c003d003c0035002f000a01000046000500050100000000000a 00080006001d00170018000b00020100000d001a001808040805080604010501020104030503 02030202060106030023000000170000ff01000100 (2) State = 0xbe5e90bfbf5e897e1fec683d113a9433 (2) Message-Authenticator = 0x3603d153e7d7ccdc99ea6b48366008bc (2) Restoring &session-state (2) &session-state:Framed-MTU = 994 (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "allan", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 0 length 172 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xbe5e90bfbf5e897e (2) eap: Finished EAP session with state 0xbe5e90bfbf5e897e (2) eap: Previous EAP request found for state 0xbe5e90bfbf5e897e, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: (TLS) EAP Peer says that the final record size will be 162 bytes (2) eap_peap: (TLS) EAP Got all data (162 bytes) (2) eap_peap: (TLS) Handshake state - before SSL initialization (2) eap_peap: (TLS) Handshake state - Server before SSL initialization (2) eap_peap: (TLS) Handshake state - Server before SSL initialization (2) eap_peap: (TLS) recv TLS 1.3 Handshake, ClientHello (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS read client hello (2) eap_peap: (TLS) send TLS 1.2 Handshake, ServerHello (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write server hello (2) eap_peap: (TLS) send TLS 1.2 Handshake, Certificate (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write certificate (2) eap_peap: (TLS) send TLS 1.2 Handshake, ServerKeyExchange (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write key exchange (2) eap_peap: (TLS) send TLS 1.2 Handshake, ServerHelloDone (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write server done (2) eap_peap: (TLS) Server : Need to read more data: SSLv3/TLS write server done (2) eap_peap: (TLS) In Handshake Phase (2) eap: Sending EAP Request (code 1) ID 1 length 1004 (2) eap: EAP session adding &reply:State = 0xbe5e90bfbc5f897e (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) session-state: Saving cached attributes (2) Framed-MTU = 994 (2) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (2) Sent Access-Challenge Id 102 from 192.168.2.124:1812 to 192.168.5.122:37035 length 1068 (2) EAP-Message = 0x010103ec19c000000487160303003d020000390303601deae904403117a0ff62321665756f 2a8ac34f2e6972d0da6bf449d21553ec00c030000011ff01000100000b000403000102001700 0016030303060b0003020002ff0002fc308202f8308201e0a00302010202140bfeb2924db4eb 8b61191c0391cbed6da696a5fc300d06092a864886f70d01010b050030143112301006035504 030c096c6f63616c686f7374301e170d3233303630383039353332315a170d33333036303530 39353332315a30143112301006035504030c096c6f63616c686f737430820122300d06092a86 4886f70d01010105000382010f003082010a0282010100b43de88ba6a8c4d3d24c75d3cb6bdb 3c827c13ec7182e9b4bbbdcaca37571e2b8b037fbce834ac5ebe0a86bdb08b2338d4422c7b5d 5335f303161d80ceee7abe945eecbaaf0b0dba1503b299be1dfb71efde8ced9e0430fb156fb2 8e344b7c8351740dfff9f58bc698a795c6ce37ac496a420e31411546250bc5a42e0d (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xbe5e90bfbc5f897e1fec683d113a9433 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 103 from 192.168.5.122:37035 to 192.168.2.124:1812 length 246 (3) User-Name = "allan" (3) NAS-IP-Address = 192.168.5.122 (3) NAS-Identifier = "62223237ad69" (3) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) Calling-Station-Id = "9C-30-5B-FF-57-C7" (3) Connect-Info = "CONNECT 0Mbps 802.11g" (3) Acct-Session-Id = "4F42900D48C05B30" (3) Acct-Multi-Session-Id = "C4E290913619F242" (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027076 (3) WLAN-AKM-Suite = 1027077 (3) WLAN-Group-Mgmt-Cipher = 1027078 (3) Filter-Id = "wpa-eap" (3) Framed-MTU = 1400 (3) EAP-Message = 0x020100061900 (3) State = 0xbe5e90bfbc5f897e1fec683d113a9433 (3) Message-Authenticator = 0x04067c606dc663fd6b1f84f9f230e053 (3) Restoring &session-state (3) &session-state:Framed-MTU = 994 (3) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "allan", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 1 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0xbe5e90bfbc5f897e (3) eap: Finished EAP session with state 0xbe5e90bfbc5f897e (3) eap: Previous EAP request found for state 0xbe5e90bfbc5f897e, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: (TLS) Peer ACKed our handshake fragment (3) eap: Sending EAP Request (code 1) ID 2 length 171 (3) eap: EAP session adding &reply:State = 0xbe5e90bfbd5c897e (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) session-state: Saving cached attributes (3) Framed-MTU = 994 (3) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (3) Sent Access-Challenge Id 103 from 192.168.2.124:1812 to 192.168.5.122:37035 length 229 (3) EAP-Message = 0x010200ab190033e205eb26a7b0e9bc7997ad9345f8b5931674f523d8e4461794515178f4a7 7e8e20944a0dd9bc4ea1890fc68b7799b544fba35b13ef7919b05b716d3b0e12334124cfe393 9c9dfac61c9a502c7656986800f513bddf742be986a6d14909f56267122c5c04a2093a5d4bd4 b0ca335050d1737b1af2443358afa6a24ac17f3a4b8f4a0647671bdc0d3d9d11023de78c4e98 1d323ddc90186d6fd51f5b16030300040e000000 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xbe5e90bfbd5c897e1fec683d113a9433 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 104 from 192.168.5.122:37035 to 192.168.2.124:1812 length 343 (4) User-Name = "allan" (4) NAS-IP-Address = 192.168.5.122 (4) NAS-Identifier = "62223237ad69" (4) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Calling-Station-Id = "9C-30-5B-FF-57-C7" (4) Connect-Info = "CONNECT 0Mbps 802.11g" (4) Acct-Session-Id = "4F42900D48C05B30" (4) Acct-Multi-Session-Id = "C4E290913619F242" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027076 (4) WLAN-AKM-Suite = 1027077 (4) WLAN-Group-Mgmt-Cipher = 1027078 (4) Filter-Id = "wpa-eap" (4) Framed-MTU = 1400 (4) EAP-Message = 0x0202006719800000005d16030300251000002120016176b9170c31bdd407fa5bfc7952c01e b2f7a8b56887ff0b6d1e6d8e2d0a2214030300010116030300280000000000000000d1687819 23a438e86441b94ffd0e0f7ba7fd46f2cc7666b0e065ba2ca03aff0f (4) State = 0xbe5e90bfbd5c897e1fec683d113a9433 (4) Message-Authenticator = 0x001457380a1d038890226978cac9b672 (4) Restoring &session-state (4) &session-state:Framed-MTU = 994 (4) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "allan", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 2 length 103 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0xbe5e90bfbd5c897e (4) eap: Finished EAP session with state 0xbe5e90bfbd5c897e (4) eap: Previous EAP request found for state 0xbe5e90bfbd5c897e, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: (TLS) EAP Peer says that the final record size will be 93 bytes (4) eap_peap: (TLS) EAP Got all data (93 bytes) (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write server done (4) eap_peap: (TLS) recv TLS 1.2 Handshake, ClientKeyExchange (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS read client key exchange (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS read change cipher spec (4) eap_peap: (TLS) recv TLS 1.2 Handshake, Finished (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS read finished (4) eap_peap: (TLS) send TLS 1.2 ChangeCipherSpec (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write change cipher spec (4) eap_peap: (TLS) send TLS 1.2 Handshake, Finished (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write finished (4) eap_peap: (TLS) Handshake state - SSL negotiation finished successfully (4) eap_peap: (TLS) Connection Established (4) eap_peap: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (4) eap_peap: TLS-Session-Version = "TLS 1.2" (4) eap: Sending EAP Request (code 1) ID 3 length 57 (4) eap: EAP session adding &reply:State = 0xbe5e90bfba5d897e (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) session-state: Saving cached attributes (4) Framed-MTU = 994 (4) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (4) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (4) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (4) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (4) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (4) TLS-Session-Version = "TLS 1.2" (4) Sent Access-Challenge Id 104 from 192.168.2.124:1812 to 192.168.5.122:37035 length 115 (4) EAP-Message = 0x01030039190014030300010116030300280c33919c73d07e1321e924e7966c00869172f231 64a26225f60498230a2032b3369d0d5accfdf80f (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xbe5e90bfba5d897e1fec683d113a9433 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 105 from 192.168.5.122:37035 to 192.168.2.124:1812 length 246 (5) User-Name = "allan" (5) NAS-IP-Address = 192.168.5.122 (5) NAS-Identifier = "62223237ad69" (5) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) Calling-Station-Id = "9C-30-5B-FF-57-C7" (5) Connect-Info = "CONNECT 0Mbps 802.11g" (5) Acct-Session-Id = "4F42900D48C05B30" (5) Acct-Multi-Session-Id = "C4E290913619F242" (5) WLAN-Pairwise-Cipher = 1027076 (5) WLAN-Group-Cipher = 1027076 (5) WLAN-AKM-Suite = 1027077 (5) WLAN-Group-Mgmt-Cipher = 1027078 (5) Filter-Id = "wpa-eap" (5) Framed-MTU = 1400 (5) EAP-Message = 0x020300061900 (5) State = 0xbe5e90bfba5d897e1fec683d113a9433 (5) Message-Authenticator = 0x10da78f8f0426bd9317a65f569037fda (5) Restoring &session-state (5) &session-state:Framed-MTU = 994 (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (5) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (5) &session-state:TLS-Session-Version = "TLS 1.2" (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "allan", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 3 length 6 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0xbe5e90bfba5d897e (5) eap: Finished EAP session with state 0xbe5e90bfba5d897e (5) eap: Previous EAP request found for state 0xbe5e90bfba5d897e, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: (TLS) Peer ACKed our handshake fragment. handshake is finished (5) eap_peap: Session established. Decoding tunneled attributes (5) eap_peap: PEAP state TUNNEL ESTABLISHED (5) eap: Sending EAP Request (code 1) ID 4 length 40 (5) eap: EAP session adding &reply:State = 0xbe5e90bfbb5a897e (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) session-state: Saving cached attributes (5) Framed-MTU = 994 (5) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (5) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (5) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (5) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (5) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (5) TLS-Session-Version = "TLS 1.2" (5) Sent Access-Challenge Id 105 from 192.168.2.124:1812 to 192.168.5.122:37035 length 98 (5) EAP-Message = 0x010400281900170303001d0c33919c73d07e147c5cb343f67cdcad81596b76f896e8cbcbc0 0eb6b3 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0xbe5e90bfbb5a897e1fec683d113a9433 (5) Finished request Waking up in 3.9 seconds. (6) Received Access-Request Id 106 from 192.168.5.122:37035 to 192.168.2.124:1812 length 281 (6) User-Name = "allan" (6) NAS-IP-Address = 192.168.5.122 (6) NAS-Identifier = "62223237ad69" (6) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (6) NAS-Port-Type = Wireless-802.11 (6) Service-Type = Framed-User (6) Calling-Station-Id = "9C-30-5B-FF-57-C7" (6) Connect-Info = "CONNECT 0Mbps 802.11g" (6) Acct-Session-Id = "4F42900D48C05B30" (6) Acct-Multi-Session-Id = "C4E290913619F242" (6) WLAN-Pairwise-Cipher = 1027076 (6) WLAN-Group-Cipher = 1027076 (6) WLAN-AKM-Suite = 1027077 (6) WLAN-Group-Mgmt-Cipher = 1027078 (6) Filter-Id = "wpa-eap" (6) Framed-MTU = 1400 (6) EAP-Message = 0x020400291900170303001e0000000000000001856be726c147ab0d11960828a7242ef5b687 a7b94fce (6) State = 0xbe5e90bfbb5a897e1fec683d113a9433 (6) Message-Authenticator = 0xa3453956037a371f607a0aa0197a1324 (6) Restoring &session-state (6) &session-state:Framed-MTU = 994 (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (6) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) &session-state:TLS-Session-Version = "TLS 1.2" (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "allan", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 4 length 41 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0xbe5e90bfbb5a897e (6) eap: Finished EAP session with state 0xbe5e90bfbb5a897e (6) eap: Previous EAP request found for state 0xbe5e90bfbb5a897e, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: (TLS) EAP Done initial handshake (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state WAITING FOR INNER IDENTITY (6) eap_peap: Identity - allan (6) eap_peap: Got inner identity 'allan' (6) eap_peap: Setting default EAP type for tunneled EAP session (6) eap_peap: Got tunneled request (6) eap_peap: EAP-Message = 0x0204000a01616c6c616e (6) eap_peap: Setting User-Name to allan (6) eap_peap: Sending tunneled request to inner-tunnel (6) eap_peap: EAP-Message = 0x0204000a01616c6c616e (6) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (6) eap_peap: User-Name = "allan" (6) Virtual server inner-tunnel received request (6) EAP-Message = 0x0204000a01616c6c616e (6) FreeRADIUS-Proxied-To = 127.0.0.1 (6) User-Name = "allan" (6) WARNING: Outer and inner identities are the same. User privacy is compromised. (6) server inner-tunnel { (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [chap] = noop (6) [mschap] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "allan", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) update control { (6) &Proxy-To-Realm := LOCAL (6) } # update control = noop (6) eap: Peer sent EAP Response (code 2) ID 4 length 10 (6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) authenticate { (6) eap: Peer sent packet with method EAP Identity (1) (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: Issuing Challenge (6) eap: Sending EAP Request (code 1) ID 5 length 42 (6) eap: EAP session adding &reply:State = 0xed638baded6691b6 (6) [eap] = handled (6) } # authenticate = handled (6) } # server inner-tunnel (6) Virtual server sending reply (6) EAP-Message = 0x0105002a1a01050025109d3852ca07db2176dfe67bbba554c4fc667265657261646975732d 332e322e31 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0xed638baded6691b68be489c80a2c9a3e (6) eap_peap: Got tunneled reply code 11 (6) eap_peap: EAP-Message = 0x0105002a1a01050025109d3852ca07db2176dfe67bbba554c4fc667265657261646975732d 332e322e31 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0xed638baded6691b68be489c80a2c9a3e (6) eap_peap: Got tunneled reply RADIUS code 11 (6) eap_peap: EAP-Message = 0x0105002a1a01050025109d3852ca07db2176dfe67bbba554c4fc667265657261646975732d 332e322e31 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0xed638baded6691b68be489c80a2c9a3e (6) eap_peap: Got tunneled Access-Challenge (6) eap: Sending EAP Request (code 1) ID 5 length 73 (6) eap: EAP session adding &reply:State = 0xbe5e90bfb85b897e (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) session-state: Saving cached attributes (6) Framed-MTU = 994 (6) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (6) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (6) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (6) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (6) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) TLS-Session-Version = "TLS 1.2" (6) Sent Access-Challenge Id 106 from 192.168.2.124:1812 to 192.168.5.122:37035 length 131 (6) EAP-Message = 0x010500491900170303003e0c33919c73d07e157dafa67fcc601fad81f4ab3d19832a9f888e 8b6b6e88a3f183c22ca35b1d2e20f85ba542042dbda5ad614a234502ac64612bf6596065 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0xbe5e90bfb85b897e1fec683d113a9433 (6) Finished request Waking up in 3.8 seconds. (7) Received Access-Request Id 107 from 192.168.5.122:37035 to 192.168.2.124:1812 length 335 (7) User-Name = "allan" (7) NAS-IP-Address = 192.168.5.122 (7) NAS-Identifier = "62223237ad69" (7) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (7) NAS-Port-Type = Wireless-802.11 (7) Service-Type = Framed-User (7) Calling-Station-Id = "9C-30-5B-FF-57-C7" (7) Connect-Info = "CONNECT 0Mbps 802.11g" (7) Acct-Session-Id = "4F42900D48C05B30" (7) Acct-Multi-Session-Id = "C4E290913619F242" (7) WLAN-Pairwise-Cipher = 1027076 (7) WLAN-Group-Cipher = 1027076 (7) WLAN-AKM-Suite = 1027077 (7) WLAN-Group-Mgmt-Cipher = 1027078 (7) Filter-Id = "wpa-eap" (7) Framed-MTU = 1400 (7) EAP-Message = 0x0205005f190017030300540000000000000002a61b2f0d1d090b51e589f263c65a04a13e08 7b99a0e043c231ec296aa84d77e8b15f94075fcf1faea10393f8d0636325c1d19af5dd3555a3 fe8eeecf6a4baa8a0b6ff2972ae1579ef963752e (7) State = 0xbe5e90bfb85b897e1fec683d113a9433 (7) Message-Authenticator = 0xceaf8d8737ec657cb30cdbabc02f8a0b (7) Restoring &session-state (7) &session-state:Framed-MTU = 994 (7) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (7) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (7) &session-state:TLS-Session-Version = "TLS 1.2" (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "allan", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) eap: Peer sent EAP Response (code 2) ID 5 length 95 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0xed638baded6691b6 (7) eap: Finished EAP session with state 0xbe5e90bfb85b897e (7) eap: Previous EAP request found for state 0xbe5e90bfb85b897e, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: (TLS) EAP Done initial handshake (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state phase2 (7) eap_peap: EAP method MSCHAPv2 (26) (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x020500401a0205003b31dc589b4b65e369c6f6d99e80780ac2190000000000000000cb4911 8d1c89b35369259b51ef278084dac462c90d55337f00616c6c616e (7) eap_peap: Setting User-Name to allan (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x020500401a0205003b31dc589b4b65e369c6f6d99e80780ac2190000000000000000cb4911 8d1c89b35369259b51ef278084dac462c90d55337f00616c6c616e (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "allan" (7) eap_peap: State = 0xed638baded6691b68be489c80a2c9a3e (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x020500401a0205003b31dc589b4b65e369c6f6d99e80780ac2190000000000000000cb4911 8d1c89b35369259b51ef278084dac462c90d55337f00616c6c616e (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "allan" (7) State = 0xed638baded6691b68be489c80a2c9a3e (7) WARNING: Outer and inner identities are the same. User privacy is compromised. (7) server inner-tunnel { (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [chap] = noop (7) [mschap] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "allan", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) update control { (7) &Proxy-To-Realm := LOCAL (7) } # update control = noop (7) eap: Peer sent EAP Response (code 2) ID 5 length 64 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [files] = noop (7) sql: EXPAND %{User-Name} (7) sql: --> allan (7) sql: SQL-User-Name set to 'allan' rlm_sql (sql): Reserved connection (2) (7) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (7) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (7) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (7) sql: User found in radcheck table (7) sql: Conditional check items matched, merging assignment check items (7) sql: Cleartext-Password := "teste1234" (7) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (7) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (7) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (7) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (7) sql: --> SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (7) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (7) sql: User found in the group table (7) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (7) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (7) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (7) sql: Group "wifi": Conditional check items matched (7) sql: Group "wifi": Merging assignment check items (7) sql: Simultaneous-Use := 1 (7) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (7) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (7) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (7) sql: Group "wifi": Merging reply items rlm_sql (sql): Released connection (2) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 (7) [sql] = ok (7) [expiration] = noop (7) [logintime] = noop (7) pap: WARNING: Auth-Type already set. Not setting to PAP (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authenticate { (7) eap: Expiring EAP session with state 0xed638baded6691b6 (7) eap: Finished EAP session with state 0xed638baded6691b6 (7) eap: Previous EAP request found for state 0xed638baded6691b6, released from the list (7) eap: Peer sent packet with method EAP MSCHAPv2 (26) (7) eap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) eap_mschapv2: authenticate { (7) mschap: Found Cleartext-Password, hashing to create NT-Password (7) mschap: Creating challenge hash with username: allan (7) mschap: Client is using MS-CHAPv2 (7) mschap: Adding MS-CHAPv2 MPPE keys (7) eap_mschapv2: [mschap] = ok (7) eap_mschapv2: } # authenticate = ok (7) eap_mschapv2: MSCHAP Success (7) eap: Sending EAP Request (code 1) ID 6 length 51 (7) eap: EAP session adding &reply:State = 0xed638badec6591b6 (7) [eap] = handled (7) } # authenticate = handled (7) } # server inner-tunnel (7) Virtual server sending reply (7) EAP-Message = 0x010600331a0305002e533d4235424232423243303541463735344444324138364132443341 3930333838423731424338343144 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0xed638badec6591b68be489c80a2c9a3e (7) eap_peap: Got tunneled reply code 11 (7) eap_peap: EAP-Message = 0x010600331a0305002e533d4235424232423243303541463735344444324138364132443341 3930333838423731424338343144 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0xed638badec6591b68be489c80a2c9a3e (7) eap_peap: Got tunneled reply RADIUS code 11 (7) eap_peap: EAP-Message = 0x010600331a0305002e533d4235424232423243303541463735344444324138364132443341 3930333838423731424338343144 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0xed638badec6591b68be489c80a2c9a3e (7) eap_peap: Got tunneled Access-Challenge (7) eap: Sending EAP Request (code 1) ID 6 length 82 (7) eap: EAP session adding &reply:State = 0xbe5e90bfb958897e (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) Challenge { ... } # empty sub-section is ignored (7) session-state: Saving cached attributes (7) Framed-MTU = 994 (7) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (7) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (7) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (7) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (7) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (7) TLS-Session-Version = "TLS 1.2" (7) Sent Access-Challenge Id 107 from 192.168.2.124:1812 to 192.168.5.122:37035 length 140 (7) EAP-Message = 0x01060052190017030300470c33919c73d07e16ccd89e095ce4558f14c7614b42832eac8ab3 12aa296eebb7fd2dcc4c4bf693f961c3e2a586f6a6858070eb80b1e857dfa9b498f48b615a56 04eef0f7a30fcd (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0xbe5e90bfb958897e1fec683d113a9433 (7) Finished request Waking up in 3.8 seconds. (8) Received Access-Request Id 108 from 192.168.5.122:37035 to 192.168.2.124:1812 length 277 (8) User-Name = "allan" (8) NAS-IP-Address = 192.168.5.122 (8) NAS-Identifier = "62223237ad69" (8) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) Calling-Station-Id = "9C-30-5B-FF-57-C7" (8) Connect-Info = "CONNECT 0Mbps 802.11g" (8) Acct-Session-Id = "4F42900D48C05B30" (8) Acct-Multi-Session-Id = "C4E290913619F242" (8) WLAN-Pairwise-Cipher = 1027076 (8) WLAN-Group-Cipher = 1027076 (8) WLAN-AKM-Suite = 1027077 (8) WLAN-Group-Mgmt-Cipher = 1027078 (8) Filter-Id = "wpa-eap" (8) Framed-MTU = 1400 (8) EAP-Message = 0x020600251900170303001a000000000000000359f20e12bf0abb1492aa92af8c1154eeaab9 (8) State = 0xbe5e90bfb958897e1fec683d113a9433 (8) Message-Authenticator = 0xef11ff65c0ac70a4cc756030903a4781 (8) Restoring &session-state (8) &session-state:Framed-MTU = 994 (8) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (8) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (8) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (8) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (8) &session-state:TLS-Session-Version = "TLS 1.2" (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "allan", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 6 length 37 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0xed638badec6591b6 (8) eap: Finished EAP session with state 0xbe5e90bfb958897e (8) eap: Previous EAP request found for state 0xbe5e90bfb958897e, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: (TLS) EAP Done initial handshake (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state phase2 (8) eap_peap: EAP method MSCHAPv2 (26) (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x020600061a03 (8) eap_peap: Setting User-Name to allan (8) eap_peap: Sending tunneled request to inner-tunnel (8) eap_peap: EAP-Message = 0x020600061a03 (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = "allan" (8) eap_peap: State = 0xed638badec6591b68be489c80a2c9a3e (8) Virtual server inner-tunnel received request (8) EAP-Message = 0x020600061a03 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "allan" (8) State = 0xed638badec6591b68be489c80a2c9a3e (8) WARNING: Outer and inner identities are the same. User privacy is compromised. (8) server inner-tunnel { (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [chap] = noop (8) [mschap] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "allan", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 6 length 6 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) sql: EXPAND %{User-Name} (8) sql: --> allan (8) sql: SQL-User-Name set to 'allan' rlm_sql (sql): Reserved connection (3) (8) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (8) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (8) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (8) sql: User found in radcheck table (8) sql: Conditional check items matched, merging assignment check items (8) sql: Cleartext-Password := "teste1234" (8) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (8) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (8) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (8) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (8) sql: --> SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (8) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (8) sql: User found in the group table (8) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (8) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (8) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (8) sql: Group "wifi": Conditional check items matched (8) sql: Group "wifi": Merging assignment check items (8) sql: Simultaneous-Use := 1 (8) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (8) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (8) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (8) sql: Group "wifi": Merging reply items rlm_sql (sql): Released connection (3) (8) [sql] = ok (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: Auth-Type already set. Not setting to PAP (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0xed638badec6591b6 (8) eap: Finished EAP session with state 0xed638badec6591b6 (8) eap: Previous EAP request found for state 0xed638badec6591b6, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap: Sending EAP Success (code 3) ID 6 length 4 (8) eap: Freeing handler (8) [eap] = ok (8) } # authenticate = ok (8) # Executing section session from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) session { (8) radutmp: EXPAND /var/log/freeradius/radutmp (8) radutmp: --> /var/log/freeradius/radutmp (8) radutmp: EXPAND %{User-Name} (8) radutmp: --> allan (8) [radutmp] = ok (8) } # session = ok (8) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) post-auth { (8) sql: EXPAND .query (8) sql: --> .query (8) sql: Using query template 'query' rlm_sql (sql): Reserved connection (4) (8) sql: EXPAND %{User-Name} (8) sql: --> allan (8) sql: SQL-User-Name set to 'allan' (8) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (8) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'allan', '', 'Access-Accept', '2023-10-10 11:34:26.248564' ) (8) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'allan', '', 'Access-Accept', '2023-10-10 11:34:26.248564' ) (8) sql: SQL query returned: success (8) sql: 1 record(s) updated rlm_sql (sql): Released connection (4) (8) [sql] = ok (8) if (0) { (8) if (0) -> FALSE (8) } # post-auth = ok (8) } # server inner-tunnel (8) Virtual server sending reply (8) MS-MPPE-Encryption-Policy = Encryption-Allowed (8) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (8) MS-MPPE-Send-Key = 0x1ff08b8c79f7d2f2c2711fbe1f337d17 (8) MS-MPPE-Recv-Key = 0xbda9b1a2f2ce96ba044316d5af766a30 (8) EAP-Message = 0x03060004 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) User-Name = "allan" (8) eap_peap: Got tunneled reply code 2 (8) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (8) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (8) eap_peap: MS-MPPE-Send-Key = 0x1ff08b8c79f7d2f2c2711fbe1f337d17 (8) eap_peap: MS-MPPE-Recv-Key = 0xbda9b1a2f2ce96ba044316d5af766a30 (8) eap_peap: EAP-Message = 0x03060004 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: User-Name = "allan" (8) eap_peap: Got tunneled reply RADIUS code 2 (8) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (8) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (8) eap_peap: MS-MPPE-Send-Key = 0x1ff08b8c79f7d2f2c2711fbe1f337d17 (8) eap_peap: MS-MPPE-Recv-Key = 0xbda9b1a2f2ce96ba044316d5af766a30 (8) eap_peap: EAP-Message = 0x03060004 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: User-Name = "allan" (8) eap_peap: Tunneled authentication was successful (8) eap_peap: SUCCESS (8) eap: Sending EAP Request (code 1) ID 7 length 46 (8) eap: EAP session adding &reply:State = 0xbe5e90bfb659897e (8) [eap] = handled (8) } # authenticate = handled (8) Using Post-Auth-Type Challenge (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) Challenge { ... } # empty sub-section is ignored (8) session-state: Saving cached attributes (8) Framed-MTU = 994 (8) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (8) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (8) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (8) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (8) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (8) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (8) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (8) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (8) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (8) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (8) TLS-Session-Version = "TLS 1.2" (8) Sent Access-Challenge Id 108 from 192.168.2.124:1812 to 192.168.5.122:37035 length 104 (8) EAP-Message = 0x0107002e190017030300230c33919c73d07e17ac83230d979d46a54bff9d2c52568f723129 672f593303dbc87dec (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0xbe5e90bfb659897e1fec683d113a9433 (8) Finished request Waking up in 3.8 seconds. (9) Received Access-Request Id 109 from 192.168.5.122:37035 to 192.168.2.124:1812 length 286 (9) User-Name = "allan" (9) NAS-IP-Address = 192.168.5.122 (9) NAS-Identifier = "62223237ad69" (9) Called-Station-Id = "62-22-32-37-AD-69:TestLP" (9) NAS-Port-Type = Wireless-802.11 (9) Service-Type = Framed-User (9) Calling-Station-Id = "9C-30-5B-FF-57-C7" (9) Connect-Info = "CONNECT 0Mbps 802.11g" (9) Acct-Session-Id = "4F42900D48C05B30" (9) Acct-Multi-Session-Id = "C4E290913619F242" (9) WLAN-Pairwise-Cipher = 1027076 (9) WLAN-Group-Cipher = 1027076 (9) WLAN-AKM-Suite = 1027077 (9) WLAN-Group-Mgmt-Cipher = 1027078 (9) Filter-Id = "wpa-eap" (9) Framed-MTU = 1400 (9) EAP-Message = 0x0207002e190017030300230000000000000004ef4b4fd724ba801ea9e25cdf94e640b09a76 ec9e8dec479a6b58ea (9) State = 0xbe5e90bfb659897e1fec683d113a9433 (9) Message-Authenticator = 0x73c5d70713c64563bbaa66afd3a40572 (9) Restoring &session-state (9) &session-state:Framed-MTU = 994 (9) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (9) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (9) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (9) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (9) &session-state:TLS-Session-Version = "TLS 1.2" (9) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "allan", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 7 length 46 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0xbe5e90bfb659897e (9) eap: Finished EAP session with state 0xbe5e90bfb659897e (9) eap: Previous EAP request found for state 0xbe5e90bfb659897e, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: (TLS) EAP Done initial handshake (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state send tlv success (9) eap_peap: Received EAP-TLV response (9) eap_peap: Success (9) eap: Sending EAP Success (code 3) ID 7 length 4 (9) eap: Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (9) post-auth { (9) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (9) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (9) update { (9) &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 994 (9) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) recv TLS 1.3 Handshake, ClientHello' (9) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, ServerHello' (9) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, Certificate' (9) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, ServerKeyExchange' (9) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, ServerHelloDone' (9) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) recv TLS 1.2 Handshake, ClientKeyExchange' (9) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) recv TLS 1.2 Handshake, Finished' (9) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 ChangeCipherSpec' (9) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) send TLS 1.2 Handshake, Finished' (9) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-RSA-AES256-GCM-SHA384' (9) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2' (9) } # update = noop (9) sql: EXPAND .query (9) sql: --> .query (9) sql: Using query template 'query' rlm_sql (sql): Reserved connection (0) (9) sql: EXPAND %{User-Name} (9) sql: --> allan (9) sql: SQL-User-Name set to 'allan' (9) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (9) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'allan', '', 'Access-Accept', '2023-10-10 11:34:26.264822' ) (9) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'allan', '', 'Access-Accept', '2023-10-10 11:34:26.264822' ) (9) sql: SQL query returned: success (9) sql: 1 record(s) updated rlm_sql (sql): Released connection (0) (9) [sql] = ok (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) if (EAP-Key-Name && &reply:EAP-Session-Id) { (9) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (9) } # post-auth = ok (9) Sent Access-Accept Id 109 from 192.168.2.124:1812 to 192.168.5.122:37035 length 173 (9) MS-MPPE-Recv-Key = 0x3c7bdb7a1c70a1c50f2b9fd1624f7c7956b428dbdb3bbe1fac10fba0bf5c5b49 (9) MS-MPPE-Send-Key = 0x40c56dcbf651086c283d1e13ede5ace435e78134e23bb3600bb86dfbb69dd839 (9) EAP-Message = 0x03070004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) User-Name = "allan" (9) Framed-MTU += 994 (9) Finished request Waking up in 3.8 seconds. (0) Cleaning up request packet ID 100 with timestamp +12 due to cleanup_delay was reached (1) Cleaning up request packet ID 101 with timestamp +12 due to cleanup_delay was reached (2) Cleaning up request packet ID 102 with timestamp +12 due to cleanup_delay was reached (3) Cleaning up request packet ID 103 with timestamp +12 due to cleanup_delay was reached (4) Cleaning up request packet ID 104 with timestamp +12 due to cleanup_delay was reached Waking up in 1.0 seconds. (5) Cleaning up request packet ID 105 with timestamp +13 due to cleanup_delay was reached (6) Cleaning up request packet ID 106 with timestamp +13 due to cleanup_delay was reached (7) Cleaning up request packet ID 107 with timestamp +13 due to cleanup_delay was reached (8) Cleaning up request packet ID 108 with timestamp +13 due to cleanup_delay was reached (9) Cleaning up request packet ID 109 with timestamp +13 due to cleanup_delay was reached Ready to process requests

2 1

What's new in v4
by Alan DeKok 10 Oct '23

10 Oct '23

No, we're not ready to release v4 yet, sorry. But hopefully soon. The good news is that we're done the major re-architecture. That took much longer than planned, but actual paying work kept getting in the way. That's fine, people need to eat. :) We've made good progress in the last month or so. To the point where it's making significant improvements. This message highlights some good and bad things. First the bad: * RADIUS/TLS (radsec) isn't there. It shouldn't be hard, but we've been working on higher priority things * TTLS / PEAP / FAST / TEAP aren't there. These are harder, but not impossible. Then the good: Many things are much much, much simpler than in v4. * update sections are no longer needed. The debug output will even tell you how to convert update sections to the new syntax! &User-Name = "foo" &NAS-Port = 1 &reply.Reply-Message = "Hello %{User-Name}" * math can be done in-place: &NAS-Port = 5 + 2 &reply.Reply-Message = "Hello " + &User-Name if (&User-Name == "foo" + "bar") ... * we no longer need %{expr:...} to do math. We can just do it in place if necessary! &reply.Reply-Message := "We have 1 + 2 = %{1 + 2}" * the dynamic expansion syntax has changed to be more sane. They look like functions with comma-separated arguments v3: %{md5:foo bar baz} v4: %md5(foo, bar, baz) * The horrible alternation syntax is gone. The new syntax is simpler, and easier to read if there are multiple layers of nesting v3: %{${Stripped-User-Name}:-%{User-Name}} v4: %{&Stripped-User-Name || &User-Name} There are many, many, other fixes and features. TACACS+, DHCPv4 is fully supported. DHCPv6 (!), DNS (!!!!). and even listening to an OpenLDAP replication stream (!!!!!) Alan DeKok.

5 8

Freeradius username whitespace issue
by Kilicer, Bunyamin Bilgehan 10 Oct '23

10 Oct '23

Hello, Why freeradius does not allow whitespaces in user name? I am trying to configure but I am getting error for username includes whitespaces. Thanks in advance.

2 1

Attribute filter file - realm regex allowed?
by John Horne 10 Oct '23

10 Oct '23

Hello, Using FreeRADIUS 3.0.20, is it possible to specify the realm as a regex in the attribute filter files (/etc/raddb/mods-config/attr_filter/pre-proxy, and the post-proxy file)? I have tried using: ^.*\.plymouth\.ac\.uk$ ~^.*\.plymouth\.ac\.uk$ "^.*\.plymouth\.ac\.uk$" Although none of these cause an error, using radmin with a debug condition shows that requests do not match the above but match the DEFAULT entry. If a regex is not allowed, is it possible to do something like: plymouth.ac.uk abc.plymouth.ac.uk User-Name =* ANY ... so that both of the realms filter the same attributes? Or do I need to create a separate entry for each realm specifying the relevant attributes in each of them? Thanks, John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [https://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

2 2

build options
by Bill Schoolfield 09 Oct '23

09 Oct '23

We package freeradius with our application and the combined package is ultimately put under source control on the installed host. When building everything on the build host, the default build creates the certificate files. Basically: freeradius/etc/raddb/certs/* So upgrades of our package include new cert files every time which ends up as a revision on the install host. Is there a way to configure the make to skip the generation of certs? Basically defer this step to a post upgrade process (one outside the source control). Bill

3 3

Re: Problems to authenticate against an Azure AD -Ldap
by Uwe Faber 05 Oct '23

05 Oct '23

Hi, so i changed like in the description, see the Text below, and it workes fine with eap-tool, but when i try to use from an AP with the same user that works with the eapool i got foloowing message: (17) State = 0xc49a7b91c0156ec00a1a15f1faab1856 (17) Message-Authenticator = 0xfcd8e560453c0793ff01f894937ed387 (17) session-state: No cached attributes (17) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default-khs (17) authorize { (17) policy filter_username { (17) if (&User-Name) { (17) if (&User-Name) -> TRUE (17) if (&User-Name) { (17) if (&User-Name =~ / /) { (17) if (&User-Name =~ / /) -> FALSE (17) if (&User-Name =~ /@[^@]*@/ ) { (17) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (17) if (&User-Name =~ /\.\./ ) { (17) if (&User-Name =~ /\.\./ ) -> FALSE (17) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (17) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (17) if (&User-Name =~ /\.$/) { (17) if (&User-Name =~ /\.$/) -> FALSE (17) if (&User-Name =~ /(a)\./) { (17) if (&User-Name =~ /(a)\./) -> FALSE (17) } # if (&User-Name) = notfound (17) } # policy filter_username = notfound (17) suffix: Checking for suffix after "@" (17) suffix: Looking up realm "karlshochschule.de" for User-Name = "testuser(a)karlshochschule.de" (17) suffix: Found realm "karlshochschule.de" (17) suffix: Adding Stripped-User-Name = "testuser" (17) suffix: Adding Realm = "karlshochschule.de" (17) suffix: Authentication realm is LOCAL (17) [suffix] = ok (17) if (!&Realm) { (17) if (!&Realm) -> FALSE (17) eap: Peer sent EAP Response (code 2) ID 143 length 79 (17) eap: Continuing tunnel setup (17) [eap] = ok (17) } # authorize = ok (17) Found Auth-Type = eap (17) # Executing group from file /etc/freeradius/3.0/sites-enabled/default-khs (17) authenticate { (17) eap: Expiring EAP session with state 0xc49a7b91c0156ec0 (17) eap: Finished EAP session with state 0xc49a7b91c0156ec0 (17) eap: Previous EAP request found for state 0xc49a7b91c0156ec0, released from the list (17) eap: Peer sent packet with method EAP TTLS (21) (17) eap: Calling submodule eap_ttls to process data (17) eap_ttls: Authenticate (17) eap_ttls: Continuing EAP-TLS (17) eap_ttls: Peer indicated complete TLS record size will be 69 bytes (17) eap_ttls: Got complete TLS record (69 bytes) (17) eap_ttls: [eaptls verify] = length included (17) eap_ttls: [eaptls process] = ok (17) eap_ttls: Session established. Proceeding to decode tunneled attributes (17) eap_ttls: Got tunneled request (17) eap_ttls: EAP-Message = 0x02000020017465737475736572406b61726c73686f6368736368756c652e6465 (17) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (17) eap_ttls: Got tunneled identity of testuser(a)karlshochschule.de (17) eap_ttls: Setting default EAP type for tunneled EAP session (17) eap_ttls: Sending tunneled request (17) Virtual server inner-tunnel received request (17) EAP-Message = 0x02000020017465737475736572406b61726c73686f6368736368756c652e6465 (17) FreeRADIUS-Proxied-To = 127.0.0.1 (17) User-Name = "testuser(a)karlshochschule.de" (17) WARNING: Outer and inner identities are the same. User privacy is compromised. (17) server inner-tunnel { (17) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-khs (17) authorize { (17) policy filter_username { (17) if (&User-Name) { (17) if (&User-Name) -> TRUE (17) if (&User-Name) { (17) if (&User-Name =~ / /) { (17) if (&User-Name =~ / /) -> FALSE (17) if (&User-Name =~ /@[^@]*@/ ) { (17) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (17) if (&User-Name =~ /\.\./ ) { (17) if (&User-Name =~ /\.\./ ) -> FALSE (17) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (17) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (17) if (&User-Name =~ /\.$/) { (17) if (&User-Name =~ /\.$/) -> FALSE (17) if (&User-Name =~ /(a)\./) { (17) if (&User-Name =~ /(a)\./) -> FALSE (17) } # if (&User-Name) = notfound (17) } # policy filter_username = notfound (17) suffix: Checking for suffix after "@" (17) suffix: Looking up realm "karlshochschule.de" for User-Name = "testuser(a)karlshochschule.de" (17) suffix: Found realm "karlshochschule.de" (17) suffix: Adding Stripped-User-Name = "testuser" (17) suffix: Adding Realm = "karlshochschule.de" (17) suffix: Authentication realm is LOCAL (17) [suffix] = ok (17) update control { (17) &Proxy-To-Realm := LOCAL (17) } # update control = noop rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 227 seconds rlm_ldap (ldap): You probably need to lower "min" ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 227 seconds rlm_ldap (ldap): You probably need to lower "min" ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 224 seconds rlm_ldap (ldap): You probably need to lower "min" ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 170 seconds rlm_ldap (ldap): You probably need to lower "min" ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 170 seconds rlm_ldap (ldap): You probably need to lower "min" ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (5), 1 of 10 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.karlshochschule.de:636 ldap_create ldap_url_parse_ext(ldaps://ldap.karlshochschule.de:636) TLS: warning: cacertdir not implemented for gnutls ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP ldap.karlshochschule.de:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 20.79.97.218:636 ldap_pvt_connect: fd: 3 tm: 10 async: 0 ldap_ndelay_on: 3 attempting to connect: connect errno: 115 ldap_int_poll: fd: 3 tm: 10 ldap_is_sock_ready: 3 ldap_ndelay_off: 3 ldap_pvt_connect: 0 ldap_open_defconn: successful ldap_send_server_request rlm_ldap (ldap): Waiting for bind result... ldap_result ld 0x555727575600 msgid 1 wait4msg ld 0x555727575600 msgid 1 (timeout 20000000 usec) wait4msg continue ld 0x555727575600 msgid 1 all 1 ** ld 0x555727575600 Connections: * host: ldap.karlshochschule.de port: 636 (default) refcnt: 2 status: Connected last used: Mon Oct 2 10:48:04 2023 ** ld 0x555727575600 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x555727575600 request count 1 (abandoned 0) ** ld 0x555727575600 Response Queue: Empty ld 0x555727575600 response count 0 ldap_chkResponseList ld 0x555727575600 msgid 1 all 1 ldap_chkResponseList returns ld 0x555727575600 NULL ldap_int_select read1msg: ld 0x555727575600 msgid 1 all 1 read1msg: ld 0x555727575600 msgid 1 message type bind read1msg: ld 0x555727575600 0 new referrals read1msg: mark request completed, ld 0x555727575600 msgid 1 request done: ld 0x555727575600 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ldap_msgfree rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (5) (17) ldap: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (17) ldap: --> (cn=testuser) (17) ldap: Performing search in "OU=AADDC Users,dc=karlshochschule,dc=de" with filter "(cn=testuser)", scope "sub" ldap_search_ext put_filter: "(cn=testuser)" put_filter: simple put_simple_filter: "cn=testuser" ldap_build_search_req ATTRS: userPassword ntPassword ldap_send_initial_request ldap_send_server_request (17) ldap: Waiting for search result... ldap_result ld 0x555727575600 msgid 2 wait4msg ld 0x555727575600 msgid 2 (timeout 20000000 usec) wait4msg continue ld 0x555727575600 msgid 2 all 1 ** ld 0x555727575600 Connections: * host: ldap.karlshochschule.de port: 636 (default) refcnt: 2 status: Connected last used: Mon Oct 2 10:48:04 2023 ** ld 0x555727575600 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x555727575600 request count 1 (abandoned 0) ** ld 0x555727575600 Response Queue: Empty ld 0x555727575600 response count 0 ldap_chkResponseList ld 0x555727575600 msgid 2 all 1 ldap_chkResponseList returns ld 0x555727575600 NULL ldap_int_select read1msg: ld 0x555727575600 msgid 2 all 1 read1msg: ld 0x555727575600 msgid 2 message type search-entry read1msg: ld 0x555727575600 msgid 2 message type search-result read1msg: ld 0x555727575600 0 new referrals read1msg: mark request completed, ld 0x555727575600 msgid 2 request done: ld 0x555727575600 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) adding response ld 0x555727575600 msgid 2 type 101: ldap_parse_result ldap_get_dn (17) ldap: User object found at DN "CN=testuser,OU=AADDC Users,DC=karlshochschule,DC=de" (17) ldap: Processing user attributes ldap_get_values_len ldap_get_values_len (17) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (17) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) ldap_msgfree rlm_ldap (ldap): Released connection (5) Need 4 more connections to reach min connections (5) rlm_ldap (ldap): Opening additional connection (6), 1 of 9 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.karlshochschule.de:636 ldap_create ldap_url_parse_ext(ldaps://ldap.karlshochschule.de:636) TLS: warning: cacertdir not implemented for gnutls ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP ldap.karlshochschule.de:636 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying 20.79.97.218:636 ldap_pvt_connect: fd: 4 tm: 10 async: 0 ldap_ndelay_on: 4 attempting to connect: connect errno: 115 ldap_int_poll: fd: 4 tm: 10 ldap_is_sock_ready: 4 ldap_ndelay_off: 4 ldap_pvt_connect: 0 ldap_open_defconn: successful ldap_send_server_request rlm_ldap (ldap): Waiting for bind result... ldap_result ld 0x5557273b7d10 msgid 1 wait4msg ld 0x5557273b7d10 msgid 1 (timeout 20000000 usec) wait4msg continue ld 0x5557273b7d10 msgid 1 all 1 ** ld 0x5557273b7d10 Connections: * host: ldap.karlshochschule.de port: 636 (default) refcnt: 2 status: Connected last used: Mon Oct 2 10:48:04 2023 ** ld 0x5557273b7d10 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x5557273b7d10 request count 1 (abandoned 0) ** ld 0x5557273b7d10 Response Queue: Empty ld 0x5557273b7d10 response count 0 ldap_chkResponseList ld 0x5557273b7d10 msgid 1 all 1 ldap_chkResponseList returns ld 0x5557273b7d10 NULL ldap_int_select read1msg: ld 0x5557273b7d10 msgid 1 all 1 read1msg: ld 0x5557273b7d10 msgid 1 message type bind read1msg: ld 0x5557273b7d10 0 new referrals read1msg: mark request completed, ld 0x5557273b7d10 msgid 1 request done: ld 0x5557273b7d10 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ldap_msgfree rlm_ldap (ldap): Bind successful (17) [ldap] = ok (17) if ((ok || updated) && User-Password && !control:Auth-Type) { (17) if ((ok || updated) && User-Password && !control:Auth-Type) -> FALSE (17) } # authorize = ok (17) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (17) Failed to authenticate the user (17) Using Post-Auth-Type Reject (17) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-khs (17) Post-Auth-Type REJECT { (17) inner_tunnel_linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (17) inner_tunnel_linelog: --> messages.Access-Reject (17) inner_tunnel_linelog: EXPAND Login incorrect: [%{User-Name}] (%{request:Module-Failure-Message}) (cli %{outer.request:Calling-Station-Id} via TLS tunnel) (17) inner_tunnel_linelog: --> Login incorrect: [testuser(a)karlshochschule.de] (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject) (cli 90-9C-4A-B9-FD-41 via TLS tunnel) (17) [inner_tunnel_linelog] = ok (17) attr_filter.access_reject: EXPAND %{User-Name} (17) attr_filter.access_reject: --> testuser(a)karlshochschule.de (17) attr_filter.access_reject: Matched entry DEFAULT at line 11 (17) [attr_filter.access_reject] = updated (17) update outer.session-state { (17) &Module-Failure-Message := &request:Module-Failure-Message -> 'No Auth-Type found: rejecting the user via Post-Auth-Type = Reject' (17) } # update outer.session-state = noop (17) } # Post-Auth-Type REJECT = updated (17) EXPAND badpass (17) --> badpass (17) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [testuser/<no User-Password attribute>] (from client 10.09.9.240 port 0 via TLS tunnel) badpass (17) } # server inner-tunnel (17) Virtual server sending reply (17) eap_ttls: Got tunneled Access-Reject (17) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (17) eap: Sending EAP Failure (code 4) ID 143 length 4 (17) eap: Failed in EAP select (17) [eap] = invalid (17) } # authenticate = invalid (17) Failed to authenticate the user (17) Using Post-Auth-Type Reject (17) # Executing group from file /etc/freeradius/3.0/sites-enabled/default-khs *********************************************************************** ldap { server = 'ldaps://ldap.karlshochschule.de' port = 636 identity = 'CN=Bind User,OU=AADDC Users,dc=karlshochschule,dc=de' password = password base_dn = 'OU=AADDC Users,dc=karlshochschule,dc=de' user { preprocess suffix base_dn = "${..base_dn}" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" } update { control:Password-With-Header += 'userPassword' control:NT-Password := 'ntPassword' } post-auth { update { description := "Authenticated at %S" } } options { ldap_debug = 0xFFFF } tls { ca_file = /etc/ssl/certs/ca-certificates.crt ca_path = /etc/ssl/certs/ certificate_file = /etc/ssl/private/rad-ka-swlan.karlshochschule.de.crt private_key_file = /etc/ssl/private/rad-ka-swlan.karlshochschule.de.key } } ************************************************************************ eap { default_eap_type = ttls max_sessions = ${max_requests} tls-config tls-common { #certificate_file = ${certdir}/name-of-certificate-file.pem #private_key_file = ${certdir}/name-of-private-key-file.key #dh_file = ${certdir}/dh certificate_file = /etc/ssl/private/rad-ka-swlan.karlshochschule.de.crt private_key_file = /etc/ssl/private/rad-ka-swlan.karlshochschule.de.key ca_file = /etc/ssl/certs/ca-certificates.crt cipher_list = "DEFAULT !kRSA !PSK !SRP !SSLv3" ecdh_curve = "" } ttls { tls = tls-common virtual_server = inner-tunnel } peap { tls = tls-common virtual_server = inner-tunnel } } *********************************************************************** server inner-tunnel { authorize { filter_username suffix update control { &Proxy-To-Realm := LOCAL } ldap if ((ok || updated) && User-Password && !control:Auth-Type) { update { control:Auth-Type := ldap } } } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } post-auth { inner_tunnel_linelog Post-Auth-Type REJECT { inner_tunnel_linelog attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } ********************************************************************************************************** server default { listen { type = auth ipv4addr = * port = 0 } authorize { filter_username suffix if (!&Realm) { reject } eap { ok = return } } authenticate { eap } post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY } } update { &reply: += &session-state: } outer_linelog remove_reply_message_if_eap Post-Auth-Type REJECT { outer_linelog attr_filter.access_reject eap remove_reply_message_if_eap } } pre-proxy { } post-proxy { eap } } *******************************************************************************************************************************

3 5